sslsplit: Certificate error: loading src server certificate failed
This is very similar to #246. I’m running Kali 2019.1 with SSLsplit 0.5.4 and see the “loading src server certificate failed” error… I tested the same commands using SSLsplit 0.5.2 and everything works fine.
Below are the commands that I used to set up the server, client and SSLsplit. The failing output from the server, client and SSLsplit are attached.
Server
The default options were used for the openssl req command.
openssl genrsa -out server.key 2048
openssl req -new -key server.key -out server.csr
openssl x509 -req -in server.csr -signkey server.key -out server_signed_cert.pem
openssl s_server -accept 9999 -key server.key -cert server_signed_cert.pem -debug
SSLsplit
The default options were used for the openssl req command.
openssl genrsa -out fake.key 2048
openssl req -new -key fake.key -out fake.csr
openssl x509 -req -in fake.csr -signkey fake.key -out fake_signed_cert.pem
sslsplit -D -c fake_signed_cert.pem -k fake.key ssl 0.0.0.0 8888 192.168.128.129 9999
Connections
Initial connection directly to server to prove the server/client works fine:
openssl s_client -connect 192.168.128.129:9999
Follow up connection via SSLsplit:
openssl s_client -connect 192.168.128.134:8888
openssl-client-trace.txt openssl-server-trace.txt sslsplit-trace.txt
About this issue
- Original URL
- State: closed
- Created 5 years ago
- Comments: 23 (2 by maintainers)
Commits related to this issue
- Increase RSA key size to 2048 for OpenSSL 1.1.1 and up, fixes issue #248, reported by multiple users Otherwise gives a "key too small" error while loading forged cert into SSL ctx — committed to droe/sslsplit by sonertari 5 years ago
- Increase the default RSA key size to 2048, see issue #248 — committed to droe/sslsplit by sonertari 5 years ago
- Lower OpenSSL security level to 0 and update documentation Issue: #248 — committed to droe/sslsplit by droe 5 years ago
It turns out that this issue is not related to OpenSSL, but Debian! Please read the explanation of Debian Security Level Update here. So, as explained there, you can fix this issue by changing the last section in
/etc/ssl/openssl.cnfto something like (which drops the security level from 2 to 1):So I should modify the
rsa-key-sizebranch based on this finding.